CVE-2026-105482

What it actually does

Node.js dns.resolve*() and dns.reverse() functions silently truncate hostnames at embedded NUL bytes before passing them to c-ares, allowing an attacker-controlled prefix to be resolved instead of the validated name.

Why it matters to the business

Applications performing hostname allowlist checks before DNS resolution may connect to attacker-controlled endpoints, risking data disclosure or unauthorized access; urgency is moderate given four-day-old disclosure and low exploitation probability.

How an attack unfolds

An attacker supplies a crafted hostname such as attacker.example\0.trusted.example to an application that validates the full string against a domain list and then calls dns.resolve*(); the NUL causes resolution of only the attacker domain, returning its records without error.

How to fix it

Upgrade affected Node.js 22.x, 24.x, and 26.x installations to the latest patched releases as soon as they become available; sanitize or reject hostnames containing NUL bytes before DNS calls; prefer dns.lookup() where possible until full remediation.

How to confirm the fix worked

Inventory running Node.js versions across environments; test dns.resolve*() and dns.reverse() with a hostname containing a literal NUL byte to confirm truncation behavior is eliminated after upgrade.

Typical attack path

1. Attacker supplies hostname containing embedded NUL byte to application input path
2. Application performs domain validation or allowlist check on the full string
3. Application invokes dns.resolve*() or dns.reverse() on the input
4. c-ares truncation causes lookup of attacker-controlled prefix only
5. Application receives and acts on records belonging to the attacker domain

How to detect it

Search DNS and application logs for hostnames containing embedded null bytes or unusual truncation patterns; review process execution and network flows for resolutions that deviate from validated names.

• hostnames containing \x00 or %00 sequences in DNS query logs
• dns.resolve* or dns.reverse calls with strings matching attacker.example\0 pattern
• c-ares resolution logs showing truncated names after NUL byte

What your security team should do

• Apply Node.js security updates immediately upon release for 22.x/24.x/26.x branches
• Audit application code for direct use of dns.resolve*() and dns.reverse() on externally supplied names
• Add input sanitization to strip or block NUL bytes in any hostname before DNS operations
• Monitor EPSS and KEV feeds for changes in exploitation likelihood